Refresh Token Inaccessible

I'm using this plugin to authenticate using JWT and Oauth2 (via Keycloak)

There is a accessToken api call provided in the RestOauthController where a valid refreshToken can be provided to request/generate a fresh accessToken. But how is one supposed to retrieve/surface the refreshToken initially generated for the first AccessToken? I cant find any documentation on this, and looking at the source code it doesn't seem possible?

Pointers greatly appreciated

Start with the RestOauthController accessToken API and trace how the initial access token response is built when using JWT/OAuth2 with Keycloak. Clarify whether the expected outcome is to expose the generated refresh token or document an existing retrieval path; done means the intended refresh-token flow is available and verifiable.

Written by the indexing model from the issue text.